UCSF home page UCSF home page About UCSF Search UCSF UCSF Medical Center
UCSF navigation bar
1. Introduction  
2. Setting up Office and Research Space
2.1 What should I do before I get to UCSF?
2.2 What should I do once I arrive at UCSF?
2.3 What Research Support Services are available?
3. Obtaining Regulatory Committee Approvals
3.1 Making Sense of Regulations
3.2 What is Research Online
3.3 Working with Biologicals
3.4 Working with Chemicals
3.5 Working with Radioactive Materials
3.6 Working with Radioactive Materials in Humans
3.7 Working with Controlled Substances
3.8 Working with Animals
3.9 Involving Human Subjects in Research
3.10 Serving on Committees
3.11 Working with Affiliates
4. Finding, Obtaining, and Managing Money
4.1 Fiscal Responsibility
4.2 Pre-award: How do I find and ask for funds?
4.3 Post-award: How do I manage funding awards?
4.4 Working with Industry
4.5 Minimizing Financial Conflicts of Interest
4.6 Intellectual Property
5. Being Responsible
5.1 Ethical Conduct of Research
5.2 Authorship and Publication
5.3 Confidentiality and Privacy
5.4 Data Management: Research Records
5.5 Training in Responsible Conduct of Research
5.6 Guidelines for Lab Notebooks
6. Leaving or Transferring Funds/Specimens Out of UCSF
 
Appendices
I. UCSF Acronyms
II. UCSF Research Links
III. Whistleblower Policies & Procedures
 
School of Medicine Clinical and Translational Research

THE OFFICE OF RESEARCH

RESEARCH INVESTIGATOR HANDBOOK

5. BEING RESPONSIBLE

5.3 CONFIDENTIALITY AND PRIVACY

What types of confidential information would I see as PI?
Are there any special requirements for collaborations?
What are my responsibilities?
What Does HIPAA have to do With My Research?
Relevant Policies and Procedures


What types of confidential information would I see as PI?

As a Principal Investigator, you may be asked to review grant proposals, scientific manuscripts, academic reviews of your colleagues. You may also see confidential records of your staff or collect human subjects data.

All of these activities require that you protect names, unpublished data, concepts, private and personal information that may affect publication, intellectual property rights, reputation and privacy. Research activities that require your protection of confidential information include:

 •    Peer Review:
  •  Proposal Review
  •  Protocol Review
  •  Manuscript Review
  •  Confidential academic reviews
 •  Human subjects research:
  •  Case Report Forms
  •  Research records in any format
  •  Verbal information provided by subject
 •  Medical Records
 •  Staff records:
  •  Staff employment records
  •  Staff protected health information
Top of page

Are there any special requirements for collaborations?

For collaborations involving industry, partnerships and other contracts, confidentiality is usually specified in the terms and conditions of the contract negotiated by the Office of Sponsored Research or Office of Technology Management. Discretion is expected with respect to disclosing information that may affect future patents and licensing agreements.

For other types of collaborations, you should work out in advance with your collaborators what types of information may be made public before publication.

What are my responsibilities?

As UCSF faculty, you are expected to practice discretion and maintain the highest level of confidentiality in all aspects of your research. You are expected to comply with all Federal regulations, State laws, and University of California directives to protect the privacy of individuals. This includes staff, UCSF personnel, your colleagues, human research participants and anyone with whom you may have access to confidential information.

What Does HIPAA have to do With My Research?

The Health Information Portability and Accountability Act (HIPAA), April 14, 2003, specifically mandated that all identifiable health information must be protected from inappropriate or unauthorized disclosure. This information is referred to as “protected health information” (PHI) and is specifically defined by HIPAA for institutions as well as researchers.  Recent regulations such as SB 1386, AB 1298, and the 2009 Health Information Technology for Economic and Clinical Health Act require notification to affected individual if their unsecured or unencrypted electronic personal or health records are breached. The fines could be significant.

As a researcher, HIPAA applies to both medical and basic research, as you must protect all staff, patient, and human subjects information that you may collect as part of your research. As a member of the UCSF workforce, HIPAA applies to all PHI regardless of it’s whether it for a staff member, faculty, research fellows, students, or UCSF patients. As a researcher, you need to consider physical security of all such data and encryption for all laptops and portable electronic data storage devices in your department.

Specific guidance, forms, and training for UCSF is posted at the following websites:

  UCSF HIPAA Implementation (general HIPAA both privacy and security)
  •  HIPAA Documentation and Forms (does not include human research forms)
  •  HIPAA Education and Training (online modules)
  •  UCSF Committee for Human Research: (CHR)
  •  HIPAA and human research (guidance, forms)
  •  HIPAA research training for investigators and their staff
•  Informed consent guidance (Section G (2.C.e)
Top of page

Relevant Policies and Procedures

  University of California:
  •  UC Protection of Personal Information policy
  •  UC Guidance on HIPAA
  Federal:
  •  Bioethics Resources on the Web - National Institutes of Health
  •  NIH guides on HIPAA
•  ORI - Office of Research Integrity (DHHS)